Se usó la API de Cloud Translation para traducir esta página.

Personaliza una configuración de OAuth para habilitar IAP

En este documento, se describe cuándo y cómo personalizar una configuración de OAuth para Identity-Aware Proxy (IAP).

IAP usa un cliente de OAuth administrado por Google para autenticar a los usuarios.

El cliente de OAuth administrado por Google restringe el acceso a los usuarios de la misma organización cuando acceden a aplicaciones habilitadas para IAP a través de un navegador.

Cuándo usar una configuración de OAuth personalizada

Debes usar una configuración de OAuth personalizada para hacer lo siguiente:

Para permitir el acceso a aplicaciones habilitadas para IAP a usuarios ajenos a la organización.
Para mostrar tu propia información de marca durante la autenticación.
Para habilitar el acceso programático a tu aplicación.

Cuando personalices tu configuración de OAuth, debes configurar la pantalla de consentimiento de OAuth. Esto requiere que la información de desarrollo de la marca de tu aplicación pase por el proceso de verificación de Google. Para obtener más información sobre el proceso de verificación, consulta Configura tu pantalla de consentimiento de OAuth.

Eres responsable de crear y administrar las credenciales de un cliente de OAuth personalizado. Esto incluye almacenar el secreto del cliente de forma segura y compartirlo con los usuarios autorizados cuando sea necesario.

Comparación entre el cliente de OAuth administrado por Google y el cliente de OAuth personalizado

Los clientes de OAuth administrados por Google no pueden acceder de forma programática a las aplicaciones protegidas con IAP. Sin embargo, se puede acceder de forma programática a las aplicaciones protegidas por IAP que usan el cliente de OAuth administrado por Google con un cliente de OAuth independiente configurado a través de la configuración de programmatic_clients o un JWT de cuenta de servicio.

En la siguiente tabla, se muestra una comparación entre el cliente de OAuth administrado por Google y un cliente de OAuth personalizado.

	Cliente de OAuth administrado por Google	Cliente de OAuth personalizado
Usuarios	Solo para uso interno	Socios internos y externos
Brand	Google Cloud marca	Marca propiedad del cliente
Configuración de OAuth	Configuración de Google	Configuración del cliente
Credenciales de OAuth	Administrado por Google	Administrada por el cliente
Acceso de aplicaciones	Solo flujo de navegador	Flujo del navegador y acceso programático

Habilita IAP con una configuración personalizada del cliente de OAuth

En las siguientes secciones, se explica cómo habilitar la IAP con una configuración personalizada del cliente de OAuth para diferentes recursos.

App Engine

Console

Dynamic include file

If you haven't configured your project's OAuth consent screen, you'll be prompted to do so. To configure your OAuth consent screen, see Setting up your OAuth consent screen.

Setting up IAP access

Go to the Identity-Aware Proxy page.
Go to the Identity-Aware Proxy page
Select the project you want to secure with IAP.
Select the checkbox next to the resource you want to grant access to.
On the right side panel, click Add principal.
In the Add principals dialog that appears, enter the email addresses of groups or individuals who should have the IAP-secured Web App User role for the project.
The following kinds of principals can have this role:
- Google Account: user@gmail.com
- Google Group: admins@googlegroups.com
- Service account: server@example.gserviceaccount.com
- Google Workspace domain: example.com
Make sure to add a Google Account that you have access to.
Select Cloud IAP > IAP-secured Web App User from the Roles drop-down list.
Click Save.

Turning on IAP

On the Identity-Aware Proxy page, under APPLICATIONS, find the application you want to restrict access to. To turn on IAP for a resource,
In the Turn on IAP window that appears, click Turn On to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with the IAP-Secured Web App User role on the project will be given access.

gcloud

Before you set up your project and IAP, you need an up-to-date version of gcloud CLI. For instructions on how to install the gcloud CLI, see Install the gcloud CLI.

To authenticate, use the Google Cloud CLI and run the following command.
```
gcloud auth login
```
To sign in, follow the URL that appears.
After you sign in, copy the verification code that appears and paste it in the command line.
Run the following command to specify the project that contains the resource that you want to protect with IAP.
```
gcloud config set project PROJECT_ID
```
Follow the instructions in Creating OAuth clients for IAP to configure the OAuth consent screen and create the OAuth client.
Save the OAuth client ID and secret.

To enable IAP, run the following command.

gcloud iap web enable \
    --oauth2-client-id=CLIENT_ID \
    --oauth2-client-secret=CLIENT_SECRET \
    --resource-type=app-engine

After you enable IAP, you can use the gcloud CLI to modify the IAP access policy using the IAM role roles/iap.httpsResourceAccessor. Learn more about managing roles and permissions.

API

Follow the instructions in Creating OAuth clients for IAP to configure the OAuth consent screen and create the OAuth client.
Save the OAuth client ID and secret.

Run the following command to prepare a settings.json file.

cat << EOF > settings.json
{
"iap":
  {
    "enabled": true,
    "oauth2ClientId": "CLIENT_ID",
    "oauth2ClientSecret":" CLIENT_SECRET"
  }
}
EOF

Run the following command to enable IAP.

curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-d @settings.json \
"https://appengine.googleapis.com/v1/apps/PROJECT_ID?updateMask=iap"

After you enable IAP, you can use the Google Cloud CLI to modify the IAP access policy using the IAM role roles/iap.httpsResourceAccessor. Learn more about managing roles and permissions.

Compute Engine

Console

If you haven't configured your project's OAuth consent screen, you'll be prompted to do so. To configure your OAuth consent screen, see Setting up your OAuth consent screen.

If you are running GKE clusters version 1.24 or later, you can configure IAP and GKE by using the Kubernetes Gateway API. To do so, complete the following steps and then follow the instructions in Configure IAP. Do not configure BackendConfig.

Setting up IAP access

Go to the Identity-Aware Proxy page.
Go to the Identity-Aware Proxy page
Select the project you want to secure with IAP.
Select the checkbox next to the resource you want to grant access to.

If you don't see a resource, ensure that the resource is created and that the BackendConfig Compute Engine ingress controller is synced.

To verify that the backend service is available, run the following gcloud command:
gcloud compute backend-services list
On the right side panel, click Add principal.
In the Add principals dialog that appears, enter the email addresses of groups or individuals who should have the IAP-secured Web App User role for the project.
The following kinds of principals can have this role:
- Google Account: user@gmail.com
- Google Group: admins@googlegroups.com
- Service account: server@example.gserviceaccount.com
- Google Workspace domain: example.com
Make sure to add a Google Account that you have access to.
Select Cloud IAP > IAP-secured Web App User from the Roles drop-down list.
Click Save.

Turning on IAP

On the Identity-Aware Proxy page, under APPLICATIONS, find the load balancer that serves the instance group you want to restrict access to. To turn on IAP for a resource, toggle the on/off switch in the IAP column.
To enable IAP:
- At least one protocol in the load balancer frontend configuration must be HTTPS. Learn about setting up a load balancer.
- You need the compute.backendServices.update, clientauthconfig.clients.create, and clientauthconfig.clients.getWithSecret permissions. These permissions are granted by roles, such as the Project Editor role. To learn more, see Managing access to IAP-secured resources.
In the Turn on IAP window that appears, click Turn On to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with the IAP-Secured Web App User role on the project will be given access.

gcloud

Antes de configurar tu IAP y tu proyecto, necesitas una versión actualizada de la CLI de gcloud. Para obtener instrucciones sobre cómo instalar la CLI de gcloud, consulta Instala la CLI de gcloud.

Para autenticarte, usa Google Cloud CLI y ejecuta el siguiente comando.
```
gcloud auth login
```
Para acceder, sigue la URL que aparece.
Después de acceder, copia el código de verificación que aparece y pégalo en la línea de comandos.
Ejecuta el siguiente comando para especificar el proyecto que contiene el recurso que deseas proteger con IAP.
```
gcloud config set project PROJECT_ID
```
Sigue las instrucciones que se indican en Cómo crear clientes de OAuth para IAP para configurar la pantalla de consentimiento de OAuth y crear el cliente de OAuth.
Guarda el ID y el secreto de cliente de OAuth.

Para habilitar la IAP, ejecuta el comando con alcance global o regional.

Alcance global

gcloud compute backend-services update BACKEND_SERVICE_NAME \
    --global \
    --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET

Alcance regional

gcloud compute backend-services update BACKEND_SERVICE_NAME \
    --region REGION_NAME \
    --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET

Después de habilitar IAP, puedes usar la CLI de gcloud para modificar la política de acceso de IAP con el rol de IAM roles/iap.httpsResourceAccessor. Obtén más información sobre cómo administrar funciones y permisos.

API

Follow the instructions in Creating OAuth clients for IAP to configure the OAuth consent screen and create the OAuth client.
Save the OAuth client ID and secret.

Run the following command to prepare a settings.json file.

cat << EOF > settings.json
{
"iap":
  {
    "enabled": true,
    "oauth2ClientId": "CLIENT_ID",
    "oauth2ClientSecret": "CLIENT_SECRET"
  }
}
EOF

Run the following command to enable IAP.

curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-d @settings.json \
"https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/REGION/backendServices/BACKEND_SERVICE_NAME"

After you enable IAP, you can use the gcloud CLI to modify the IAP access policy using the IAM role roles/iap.httpsResourceAccessor. Learn more about managing roles and permissions.

Cloud Run

Console

If you haven't configured your project's OAuth consent screen, you're prompted to do so. To configure your OAuth consent screen, see Setting up your OAuth consent screen

Setting up IAP access

Open the Identity-Aware Proxy page.
Go to Identity-Aware Proxy
Select the project you want to secure with IAP.
Under Applications, select the checkbox next to the load balancer backend service to which you want to add members.
On the right side panel, click Add member.
In the Add members dialog, enter the accounts of groups or individuals who should have the IAP-secured Web App User role for the project. The following kinds of accounts can be members:
- Google Account: user@gmail.com - This can also be a Google Workspace account, such as user@google.com or some other Google Workspace domain.
- Google Group: admins@googlegroups.com
- Service account: server@example.gserviceaccount.com
- Google Workspace domain: example.com
Select Cloud IAP > IAP-secured Web App User from the Roles list.
Click Save.

Turning on IAP

On the IAP page, under Applications, find the load balancer backend service to which you want to restrict access. Click the IAP toggle to enable IAP on a resource.
In the Turn on IAP window that appears, click Turn On to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with the IAP-Secured Web App User role on the project will be given access.
To authorize IAP to send traffic to the backend Cloud Run service, follow the instructions at Add principals to a service to add the following principle and role.
- Principal: service-[PROJECT-NUMBER]@gcp-sa-iap.iam.gserviceaccount.com
- Role: Cloud Run Invoker

gcloud

Follow the instructions in Creating OAuth clients for IAP to configure the OAuth consent screen and create the OAuth client.
Save the OAuth client ID and secret.
If you have not previously done so, create a service account by running the following command. If you previously created a service account, running the command does not create duplicate service accounts.
```
gcloud beta services identity create \
    --service=iap.googleapis.com --project=PROJECT_ID
```

Grant the invoker permission to the service account, created in the previous step, by running the following command.

gcloud run services add-iam-policy-binding SERVICE-NAME \
    --member='serviceAccount:service-PROJECT-NUMBER@gcp-sa-iap.iam.gserviceaccount.com' \
    --role='roles/run.invoker'

Enable IAP by running either the globally or regionally scoped command, depending on whether your load balancer backend service is global or regional. Use the OAuth client ID and secret from the previous step.

Global scope
```
gcloud compute backend-services update BACKEND_SERVICE_NAME \
    --global \
    --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET
```
Regional scope
```
gcloud compute backend-services update BACKEND_SERVICE_NAME \
    --region REGION_NAME \
    --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET
```
Replace the following:
- BACKEND_SERVICE_NAME: the name of the backend service.
- CLIENT_ID: the OAuth client ID, from the previous step.
- CLIENT_SECRET: the OAuth client secret, from the previous step.
- REGION_NAME: the region in which you want to enable IAP.

After you enable IAP, you can use the Google Cloud CLI to modify the IAP access policy using the Identity and Access Management role roles/iap.httpsResourceAccessor. See Managing roles and permissions for more information.

Google Kubernetes Engine

Console

If you haven't configured your project's OAuth consent screen, you'll be prompted to do so. To configure your OAuth consent screen, see Setting up your OAuth consent screen.

Setting up IAP access

Go to the Identity-Aware Proxy page.
Go to the Identity-Aware Proxy page
Select the project you want to secure with IAP.
Select the checkbox next to the resource you want to grant access to.

If you don't see a resource, ensure that the resource is created and that the BackendConfig Compute Engine ingress controller is synced.

To verify that the backend service is available, run the following gcloud command:
gcloud compute backend-services list
On the right side panel, click Add principal.
In the Add principals dialog that appears, enter the email addresses of groups or individuals who should have the IAP-secured Web App User role for the project.
The following kinds of principals can have this role:
- Google Account: user@gmail.com
- Google Group: admins@googlegroups.com
- Service account: server@example.gserviceaccount.com
- Google Workspace domain: example.com
Make sure to add a Google Account that you have access to.
Select Cloud IAP > IAP-secured Web App User from the Roles drop-down list.
Click Save.

Turning on IAP

On the Identity-Aware Proxy page, under APPLICATIONS, find the load balancer that serves the instance group you want to restrict access to. To turn on IAP for a resource, toggle the on/off switch in the IAP column.
To enable IAP:
- At least one protocol in the load balancer frontend configuration must be HTTPS. Learn about setting up a load balancer.
- You need the compute.backendServices.update, clientauthconfig.clients.create, and clientauthconfig.clients.getWithSecret permissions. These permissions are granted by roles, such as the Project Editor role. To learn more, see Managing access to IAP-secured resources.
In the Turn on IAP window that appears, click Turn On to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with the IAP-Secured Web App User role on the project will be given access.

GKE

Configure the BackendConfig

If you are running GKE clusters version 1.24 or later, you can configure IAP and GKE by using the Kubernetes Gateway API. See Configure IAP for instructions.

Follow the instructions in Creating OAuth clients for IAP to configure the OAuth consent screen and create the OAuth client.
Create a Kubernetes Secret to wrap the OAuth client.
```
kubectl create secret generic MY_SECRET --from-literal=client_id=CLIENT_ID \
  --from-literal=client_secret=CLIENT_SECRET
```
Replace the following:
- MY_SECRET: The name of the secret to create
- CLIENT_ID: The OAuth client ID
- CLIENT_SECRET: The OAuth client secret
You should receive confirmation, like the following output, that the Secret was successfully created:
```
secret "MY_SECRET" created
```

Add the OAuth credentials to the BackendConfig.

apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: CONFIG_DEFAULT
  namespace: my-namespace
spec:
iap:
  enabled: true
  oauthclientCredentials:
    secretName: MY_SECRET

Enable IAP by associating Service ports with your BackendConfig. See Associating BackendConfig with your Ingress. One way to make this association is to make all ports for the service default to your BackendConfig, which you can do by adding the following annotation to your Service resource:
```
metadata:
  annotations:
      beta.cloud.google.com/backend-config: '{"default": "CONFIG_DEFAULT"}}'
```

After you enable IAP, you can use the gcloud CLI to modify the IAP access policy using the IAM role roles/iap.httpsResourceAccessor. Learn more about managing roles and permissions.

Troubleshooting

If the secretName you referenced doesn't exist or isn't structured properly, one of the following error messages will display:

BackendConfig default/config-default is not valid: error retrieving secret "foo": secrets "foo" not found. To resolve this error, make sure that you've created the Kubernetes Secret correctly as described in step 2.
BackendConfig default/config-default is not valid: secret "foo" missing client_secret data. To resolve this error, make sure that you've created the OAuth credentials correctly. Also, make sure that you referenced the correct client_id and client_secret keys.

Personaliza una configuración de OAuth para habilitar IAP Organiza tus páginas con colecciones Guarda y categoriza el contenido según tus preferencias.

Cuándo usar una configuración de OAuth personalizada

Comparación entre el cliente de OAuth administrado por Google y el cliente de OAuth personalizado

Habilita IAP con una configuración personalizada del cliente de OAuth

App Engine

Console

Setting up IAP access

Turning on IAP

gcloud

API

Compute Engine

Console

Setting up IAP access

Turning on IAP

gcloud

API

Cloud Run

Console

Setting up IAP access

Turning on IAP

gcloud

Google Kubernetes Engine

Console

Setting up IAP access

Turning on IAP

GKE

Configure the BackendConfig

Troubleshooting

Personaliza una configuración de OAuth para habilitar IAP